Your account data
This is everything the Inco Extensions service stores about you.
- Account: your email address, your username, the time you signed up, whether and when you verified your email address, and when you deleted the account if you did. Your password itself is never stored, only a salted PBKDF2-SHA256 hash of it. Accounts that are never verified are deleted after 7 days.
- Email codes: for verification and password resets we store a keyed hash of the 6-digit code (never the code itself), when it was made, when it expires and how many wrong tries were made. A code is deleted as soon as it is used or replaced, and expired codes are deleted automatically (codes last 15 minutes and stop working after 5 wrong tries). If you log in to an account that is scheduled for deletion, a one-time restore ticket is kept the same way for 15 minutes. The emails are sent through Proton Mail from [email protected].
- Sessions: a hash of each login token, with its start and expiry time. A session ends when you log out or after 7 days, and expired sessions are deleted automatically.
- Submissions: the name, description, version and homepage link you enter, the name and version from manifest.json, the zip's file name, size and SHA-256, the review status with any reason from the reviewer, and the zip file. The zip is deleted when a submission is rejected or removed; its details stay in your list until you delete your account.
- Abuse limits: to limit sign-ups, failed logins, emailed codes and uploads, short records with a time and a SHA-256 hash of your IP address or email address (or your account number for uploads). They are deleted automatically once they are 24 hours old (cleanup runs every hour).
- Password check: when you choose a password, the first 5 characters of its SHA-1 hash are sent to the Have I Been Pwned service to check it against leaked passwords. The password itself is never sent.
- Public: your username and the details of your listed extensions appear in the catalog. Your email address is never shown publicly; only the reviewer can see it.
- In your browser: your login token in sessionStorage, gone when you log out or close the tab, and a flag that remembers if you closed the preview banner.
- Spam check: the log in, sign-up and password reset forms use Cloudflare Turnstile, which receives your IP address to run the check. Cloudflare also hosts this site and the service.
Not collected: there is no tracking or analytics on these pages, and the extensions service keeps no request logs.
Deleting your account: use the Delete account button on this page (log in first), or email [email protected]. Your account is locked and hidden right away: you are logged out everywhere, your listed extensions leave the catalog (a cached page can show them for up to a minute), and the email address can't be used for a new account. Deletion takes effect after 14 days. Until then you can log in and choose Restore. After that, your account, sessions, email codes, all your submissions with every stored zip, and the abuse-limit records tied to your email address or account are removed for good. Records keyed only by a hashed IP address aren't linked to your account and expire within 25 hours. Copies other people already downloaded stay on their computers.
